locomotive-scroll

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The starter loads and executes remote library code at runtime via the module import in assets/starter_locomotive/main.js (import LocomotiveScroll from 'https://cdn.skypack.dev/locomotive-scroll@4'), which is a required dependency and causes execution of fetched remote code in the page.